TITLE OF THE INVENTION 

APPARATUS FOR SOLVING SYSTEM OF EQUATIONS ON FINITE FIELD 
AND APPARATUS FOR INVERTING ELEMENT OF EXTENSION FIELD 
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2000-140886 filed in Japan, the contents of which are hereby 
incorporated by reference* 

BACKGROUND OF THE INVENTION 
Field of the In vention 

The present invention relates to cryptographic and error 
correction techniques for information security, and in particular 
relates to computation techniques which use extension fields and 
systems of equations. 
Description of the Prior Art 

Secret communication or digital signature techniques have 
increasingly been used in data communication in recent years. 

Secret communication techniques allow communication to be 
performed without the communicated content being revealed to 
third parties. Digital signature techniques, meanwhile, enable 
the recipient to verify whether the communicated content is valid 
or whether the information is from the stated sender. Such 
secret communication or digital signature techniques use a 
cryptosystem called public key cryptography. Public key 



cryptography provides a convenient method for managing the 
separate encryption keys of many users, and so has become a 
fundamental technique for performing communication with a large 
number of users. 

In the public key cryptography, different keys are used for 
encryption and decryption, with the decryption key being kept 
secret and the encryption key being made public. Here, one of 
the founding principles for the security of public key 
cryptography is the so-called discrete logarithm problem. 
Representative examples of the discrete logarithm problem are 
problems based on finite fields and problems based on elliptic 
curves. Such problems are described in detail in Neal Koblitz 
(1987), A Course in Number Theory and Cryptography, Springer- 
Verlag. 

(Elliptic Curve Discrete Logarithm Problem) 

The elliptic curve discrete logarithm problem is the 
following. 

Let E be an elliptic curve defined over a finite field GF(q) 
(q=p n , p a prime, n a positive integer), with a point G on the 
elliptic curve E, given when the order of E is divisible by a 
large prime, being set as a base point. This being so, the 
problem is to find an integer x such that 

Y=x *G 

where Y is a given point on E, if such an integer x 



exists • 

In this specification, the operator * represents elliptic 
curve exponentiation, so that x*G means G is added to itself x 
times on E. Also, GF(q) is an extension field of a finite field 
GF(p). For details about extension fields, see T. Okamoto & H. 
Yamamoto (1997), Modern Encryption, Mathematics of Information 
Sciences Series, Sangyo Tosho, pp. 26-28. 

(Prior Art 1: ElGamal Signature Scheme Which Uses the Elliptic 
Curve Discrete Logarithm Problem) 

The ElGamal signature scheme using the elliptic curve 
discrete logarithm problem is described below with reference to 
Fig. 9. 

In the figure, a device 310 used by a user A (hereafter, 
"user A 310"), a management center 320, and a device 330 used by 
a user B (hereafter, "user B 330") are connected via a network. 

Let p be a prime, g=p n , n be a positive integer, and E be an 
elliptic curve over a finite field GF ( q) , with G being a base 
point of E and r being the order of G. Which is to say, r is the 
smallest positive integer that satisfies 

r*G=0 

where 0 is the zero element in the additive group on the 
elliptic curve £. 

(1) Public Key Generation by the Management Center 320 

First, the management center 320 generates a public key Y A of 



the user A 310 using the user A's secret key x A which has been 
informed beforehand, according to the equation 

(SI, S2) . 

5 The management center 320 announces the finite field GF ( q) , 

the elliptic curve E, and the base point G as system parameters, 
and reveals the public key Y A of the user A 310 to the user B 330 
(S3, S4) . 

(2) Signature Generation by the User A 310 

l(fS The user A 310 generates a random number k (S5) , calculates 

£3 R x =(r x ,r y )=k*G 
ih (S6) , and finds s satisfying 

frt s*k=m+r x *x A mod r 

C3 (S7) where in is a message to be sent from the user A 310 to 

llU the user B 330. 

53 The user A 310 sends the message m and the signature (R lf s) 

to the user B 330 (S8) . 

(3) Signature Verification by the User B 330 

The user B 330 verifies the authenticity of the user A 310 
20 by judging whether 

s fR^m *G+r x *Y A 
is true (S9) . 

This equation is derived from 

s*R x =[ ( (m+r x *x A ) /k) *k] *G 
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= (m+r x *x A ) *G 
=m*G+ (r x *x A ) *G 
=m *G+r x *Y A 

In this ElGamal digital signature scheme using the elliptic 
curve discrete logarithm problem, elliptic curve exponentiation 
is repeatedly performed to generate the public key and the 
signature and to verify the signature. 

For details on elliptic curve exponentiation, see "Efficient 
Elliptic Curve Exponentiation" in Miyaji, Ono & Cohen (1997), 
Advances in Cryptology-Proceedings of ICICS' 97 , Lecture Notes in 
Computer Science, Springer-Verlag, pp. 282-290 (hereafter 
"document 1") . 

Let an elliptic curve be defined by an equation of the 

form 

y 2 =x 3 +a *x+ b 

with some point P on the elliptic curve being represented by 
2-tuple coordinates (x 1 ,y 1 ) called affine coordinates. 

Elliptic curve exponentiation in the 2-tuple coordinate is 
known to involve inverse operations on the finite field GF(q) . 

Document 1 makes brief mention of a 3-tuple coordinate called 
projective coordinate. 2-tuple coordinates can be transformed 
into corresponding 3-tuple coordinates as shown by 

(x 1 ,y 1 )-*(x 1 ,y 1 *1) 

Elliptic curve exponentiation in the 3-tuple coordinate 




involves no inverse operations on the finite field GF(q) . Since 
inverting a finite field element generally takes considerable 
computation time, the 3-tuple coordinate is often used in 
elliptic curve exponentiation. 
5 However, when transforming 3-tuple coordinates into 

corresponding 2-tuple coordinates as shown by 

(X, Y, Z)^(X/Z,Y/Z) 
inversion on the finite field GF (q) is necessary. 
In step S6 in Fig. 9, for instance, after 2-tuple coordinates 
lCfi are transformed into 3-tuple coordinates, elliptic curve 

J«j exponentiation is performed on the 3-tuple coordinates, and the 

fpj resulting 3-tuple coordinates are transformed into corresponding 

?R 2-tuple coordinates. Inversion is needed in this transformation 

C3 of the 3-tuple coordinates to the 2-tuple coordinates. 

lJfy (Prior Art 2: Inversion in an Extension Field) 

£3 A conventional inverse operation on an extension field GF(q) 

iq^p", p a prime, n a positive integer) is performed in the 
following way. 

For simplicity's sake, a generator polynomial of the 
20 extension field GF (q) is set as f (g) =g n -(3 whose root is a, and an 

element of GF (q) to be inputted in the generator polynomial is 
set as 

x=x 0 +x 2 *a+ • • • +x n _ 2 xq/ 1 " 1 

(1) Step 1 
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Based on the element x of GF(q), a system of equations for 
y i (i=0 ,1 r . . . ,n-l) 

x ( p o +0x B _ 1 y 1 +0x a _ a y 2 +-- +Px 1 y n . 1 =l 
x^o +x o y 1 +0x„_ 1 y 2 + • • • + Px 2 Y n -i =0 
5 x 2 y 0 +x 1 y 1 + x 0 y 2 +--- +0x 3 y n _ 1 =O 

x n-iy 0 +x n- 2 yi + x n-3y 2 + ' - + x oy n -i=° 

is formed. 
1§3 (2) Step 2 

til 

p The solutions y k (k=0 , 1 , . . . ,n-l) of the system of equations 

ff\ are sought . 

ih (3) Step 3 

C3 From the solutions y k (k=0 , 1 , . . . ,n-l) , the inverse 

1§U I^Yo+Y!*** • * * +Yn-i°f~ 1 

« is calculated. Hence the inverse of the element x in the 

extension field GF(q) is obtained. 

The validity of this inverse operation is shown below. 
I f the inverse J and the element x satisfy the 
20 relationship 

xl=l mod f (g) 

then 

x l=x 0 (y 0 +y 1 ct+ - • • +y J1 - 1 a p " 1 ; 
+x 1 <x(y 0 +y 1 or+- * m +y„- x oP' 1 ) 
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+x 2 c? (Y 0 +y 1 oe+ ■ - ■ +y n - 1 oP' 1 ) 
+x n _ 1 cT 1 (Yo+y^* • • ' +y n .ioP' 1 ) 

and also 

cP=p mod f(g) 
Accordingly, 

xl=x 0 (y 0 +y 1 ct+ • • • +y n - 1 of~ 1 ) 

+x 1 (y 0 a+y 1 a?+ ■ • • +y n . 1 0) 

+x 2 (y 0 c/ ! +y 1 oP+ ■ • • +y n . 1 cxP) 

+*n-i (y o ° r ~ 1 +yi0+- • •+y n -i°?~ 2 0) 

which can be rearranged in ascending order of power of a 

into 

xl=x 0 y 0 +j8xx n _ 1 ^y 1 +' • '+/3x 1 y n _ 1 
+ct(x 1 y 0 +x 0 *y 1 +- ■ -+Px 2 y n _ 1 ) 
+a? (x 2 y 0 +x 1 y 1 + • • • +0x 3 y n _ 1 ) 

+CP' 1 (x^yo+x^ys • • • +x 0 y n _ 1 ) 

From this equation and the relationship xl=l, the system of 
equations in step 1 is derived. 

Therefore, calculating an inverse in the extension field 
GF(q) is equivalent to solving a system of equations on the basic 
field GF(p) . 

Though the foregoing example uses the generator polynomial 
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of the form g n -/3 for simplicity's sake, a system of equations can 
be formed by the same procedure for a generator polynomial of 
ordinary form. 

(Prior Art 3: Solution of a System of Equations on the basic 
field GF(p) ) 

A conventional method for solving a system of equations on 
the basic field GF(p) is described below. This method is called 
Gaussian elimination. For details on Gaussian elimination, see 
K. Mizugami (1985), Mathematical Calculations by Computers, 
Introduction to Programming Series, Asakura Shoten, pp. 76-82 
(hereafter "document 2") . 

A system of equations for x k (k=0 ,1 ,2 , . . . ,n-l) 



is solved by Gaussian elimination in the following manner. 
(Step 1) 

A matrix M and a vector v are given respectively as 



a n K o~ ha i2 x i 




a 21 K 0 + a 22 K l + 




a nl X 0 + a n2 X l+' * '+ a nn X n-l 
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a 
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a 



22 



a 



2n 



M= 




a 



n2 



a 



nn 



V- 



Meanwhile, a vector X is given as 



X= 



10 



15 



Then the above system of equations can be simply written as 
MX=\r 

The matrix M and the vector v are triangular transformed so 
as to put the matrix M into upper triangular form, as a result of 
which a matrix M r and a vector v' are generated. Here, the 
triangular transformation is such a transformation that changes 
all elements beneath the diagonal elements of a matrix to 0, and 
such a transformed matrix is called an upper triangular matrix. 

The procedure of this conventional triangular transformation 
is explained below with reference to Fig. 10. 

First, counter j is set at 1 (S21) . Next, the inverse I j of 
is computed (S22) , 1 is assigned to (S23), and a jk ^a jk ^I j and 
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b^bjXl] are set for j+lsksn (S24) . Then counter i is set at j>2 
(S25) . 

Following this, 0 is assigned to a ±j (S26) , ^ ik =^ ik -^jj x ^ jk is 
set for j+l*k<;ri (S27) , and also b^b^a^xb. is set (S28) . Then it 
is judged whether i=n (S29) . If i*n, counter i is incremented by 
1 (S31) and the procedure returns to step S26. If ±=n, it is 
judged whether j=n (S30) . If j*n, counter j is incremented by 1 
and the procedure returns to step S22. If j=n f the procedure 
ends . 

As a result, the matrix M 9 and the vector v' are obtained. 
The matrix M' is a matrix whose diagonal elements are all 1 and 
whose elements beneath the diagonal elements are all 0. 

The system of equations M'X=v' and the system of equations 
MX=v have an equivalence relation. 

Let the matrix M' and the vector v 9 be written respectively 

as 



M'= 



°11 °12 



C 21 °22 



\ 



"2n 



C nl C n2 "' °nn 



J 



d i 
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(Step 2) 

The system of equations M'X=v' is solved using the generated 
matrix M f and vector v r , in the following way. 

The values n-1, . . . , 1, 0 are set one by one in counter c 
in this order. For counter c, 

is calculated when c=n-l, and 

n-l 

y c = d c+i - 10 (c c +i ±+i*yi-i> 

is calculated when c*n-l. 
(Concrete Example) 

A concrete example of applying the prior art 3 is presented 
below. 

Note that this example is provided here only for facilitating 
the understanding of the triangular transformation, and is not an 
example of practical use in cryptographic communication or 
digital signature systems. 

When a prime p=31, a generator polynomial f (g) =g 5 -2, and an 
element x=5a +29a 3 + 6a 2 + 1 9a+l 7 of GF ( q) are given, the 
calculations 

x*a=5c? +29a +6c? +19c? +1 la 
=29a 4 + 6a 3 +1 9ct -+l 7a+5 *2 
x*cf=29a 5 +6a 4 +19a 3 +17cf+10a 
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=6a 4 +l 9a? +1 7c? +1 Oa+29 *2 
x xc?=6c?+19a 4 +l 7c? +1 Oc?+2 7a 
=1 9c? +1 7c? -hi Oc?+2 7a+6*2 
x *a 4 =l 9c? +1 7c? -hi 0c?+2 7c? -h 12a 
=1 7 a 4 -hi Oc?-h2 7c?-hl2a-hl 9 *2 
lead to a system of equations shown in Fig. 11(a), where a 
coefficient matrix 301 consists of 5 rows and 5 columns and a 
constant vector 302 consists of 5 elements. 

In the system of equations in Fig. 11(a), a linear 
equation 

1 7x0+10x^27x2+12x3+7x4=1 
is called a pivotal equation that serves as the pivot of 
transformation, and the other linear equations are called object 
equations that are to be transformed. 
First, the inverse operation 

1/17 mod 31 -12 
is performed, and then 

10x11 mod 31 =17 
27xll mod 31 =18 
12x11 mod 31 =8 
7x11 mod 31 =15 
Ixll mod 31 =11 
are calculated. As a result, the system of equations is 
transformed as shown in Fig. 11(b), where the element in the 
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first column and row has become 1 in a coefficient matrix 311. 
The elements enclosed with the boxes in the coefficient matrix 
311 and constant vector 312 in Fig, 11(b) are those which have 
changed from the coefficient matrix 301 and constant vector 302 
in Fig. 11(a). The same goes for the rest of Fig. 11. 

Here, the above inverse operation 1/17 mod 31 =11 is carried 
out by first seeking a which satisfies 

a*17+b*31=l 

by means of the extended GCD (Greatest Common Divisor) , and 
then setting a as the inversion result. 

In general, the extended GCD takes considerable computational 
complexity, as it involves repeated multiplications and 
additions. For details on the extended GCD, see H". Cohen (1996) 
"A Course in Computational Algebraic Number Theory" in Graduate 
Texts in Mathematics 138, Springer-Verlag, pp. 16-19. 

Next, 

17-17x19=4 mod 31 

10-18x19=9 mod 31 

27-8x19=30 mod 31 

12-15x19=6 mod 31 

0-11x19=8 mod 31 
are calculated to convert the element in the first column and 
second row in the coefficient matrix 311 to 0, and in a like 
manner the elements in the first column and third to fifth rows 
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in . the coefficient matrix 311 are converted to 0, thereby 
transforming the coefficient matrix 311 in Fig. 11(b) into a 
coefficient matrix 321 shown in Fig. 11(c). The constant vector 
312 is also transformed into a constant vector 322, as a result 
of which a system of equations shown in Fig. 11(c) is obtained. 

Next, the coefficient matrix 321 is transformed into a 
coefficient matrix 331 so that the element in the second column 
and row becomes 1, and the constant vector 322 is transformed 
into a constant vector 332. Hence a system of equations shown in 
Fig. 11(d) is obtained. Further, the coefficient matrix 331 is 
transformed into a coefficient matrix 341 so that the elements in 
the second column and third to fifth rows become 0, and the 
constant vector 332 is transformed into a constant vector 342. 
Hence a system of equations shown in Fig. 11(e) is obtained. 

Likewise, the element in the third column and row is 
converted to 2 in a coefficient matrix 351 in Fig. 11(f), and the 
elements in the third column and fourth to fifth rows are 
converted to 0 in a coefficient matrix 361 in Fig. 11(g). After 
this, the element in the fourth column and row is converted to I 
in a coefficient matrix 371 in Fig. 11(h), and the element in the 
fourth column and fifth row is converted to 0 in a coefficient 
matrix 381 in Fig. 11 (i). Lastly, the element in the fifth 
column and row is converted to 2 in a coefficient matrix 391 in 
Fig. 11 <j) . 
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Thus, the coefficient matrix 301 is transformed into the 
upper triangular matrix 391. 
Following this, 

Y 4 =29 

y 3 =15-21*29 

=26 mod 31 
y 2 =ll-4*26-28*29 

=25 mod 31 
y 1 =2-10*25-23x26-17*29 

=25 mod 31 
y 0 =ll-17x25-18x25-8x26-15*29 

=12 mod 31 

are computed. 
(Computational Complexity) 

The total computational complexity of the prior art 3 is 
evaluated below. Here, computational complexity of one 
multiplication on a basic field is measured as IMul and 
computational complexity of one inversion on the basic field is 
measured as llnv. 

In step 1 in the prior art 3, computational complexity for 
one value of counter j can be broken down as follows. 

(a) Step S22 involves one inversion, so that computational 
complexity is 2 In v. 

(b) Step S24 involves ( ( n - ( j + 1 ) + 1 ) + 1 ) = ( n - j + 1 ) 
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multiplications, so that computational complexity is (n- 
j+l)Mul. 

(c) For one value of counter i, step S27 involves (n- (j+1) +1) 
multiplications and so computational complexity is (n-j)Mul (cl) , 
and step S28 involves one multiplication and so computational 
complexity is lMul (c2) . Since counter i changes from j+1 to n, 
(cl) and (c2) are repeated (n- (j+1) +1) = (n-j ) times, which makes 
the computational complexity of for all values of counter c at 
((n-j) (n-j+1) )Mul. 

Summing (a), (b) , and. (c) together results in computational 
complexity of ( (n-j+1) (n-j+1) ) Mul+llnv. 

Since counter j changes from 1 to n, the total computational 
complexity of step 1 is 

£ (((n-j+1) (n-j+1)) Mul+llnv) 
j=i 

=j0( (n-j+1) (n-j+1) )Mul+£lInv 

n 

= J^j 2 Mul +nlnv 

= (l/6xn(n+l) (2n+l) )Mul+nInv 

On the other hand, computational complexity of step 2 in the 
prior art 3 is as follows. 

For one value of counter c, (n- (c+1) +1) = (n-c) multiplications 
are necessary, so that computational complexity is (n-c)Mul. 
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Since counter c changes from 1 to n, the total computational 
complexity of step 2 is 

n 

(n-c)Mul 

c=l 

=£? (c-l)Mul 

c=l 

= (£c-£l)Mul 

c=l c=l 

= (l/2*n (n+1) -n)Mul 
= (l/2*n (n -1) )Mul 

Therefore, the overall computational complexity of the prior 
art 3 is 

(l/6*n (n+1) (2n+l) +l/2*n (n-1) ) Mul+nlnv 
=1/3 *n* (n 2 +3n-l)Mul+nInv 

It is known that in a general-purpose computer Hnv=40Mul 
when n=5 and \q\=160 (|qr| is the bit size of q) . Accordingly, the 
overall computational complexity of the prior art 3 is 265Mul. 

As described above, an inverse of an element in an extension 
field can be computed by solving a system of equations on a 
finite field. Nevertheless, given that computational complexity 
of inversion needed in solving the system of equations is 
generally large, there still remains the demand to further reduce 
computational complexity of solving a system of equations on a 
finite field, and to thereby reduce computational complexity of 
inverting an extension field element. 
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SUMMARY OF THE INVENTION 

In view of the stated demand, the present invention aims to 
provide an apparatus, method, and storage medium storing a 
program for solving a system of equations on a finite field with 
reduced computational complexity, an apparatus, method, and 
storage medium storing a program for inverting an element in an 
extension field with reduced computational complexity, and a 
communication system and a record medium reproducing apparatus 
that utilize these apparatuses and methods. 

The above object can be achieved by an apparatus for use in 
encryption or decryption, for solving a system of linear 
equations Ax=b in n unknowns on a finite field GF(p), where p is 
a prime, n is a positive integer, A is a coefficient matrix 
consisting of elements of n rows and n columns, x is a vector of 
unknowns consisting of n elements, and b is a constant vector 
consisting of n elements, the apparatus including: a parameter 
storing unit for storing the coefficient matrix A and the 
constant vector b; a triangular transforming unit for reading the 
coefficient matrix A and the constant vector b from the parameter 
storing unit, and transforming the read coefficient matrix A and 
constant vector b to generate a coefficient matrix C and a 
constant vector d for a system of linear equations Cx=d in n 
unknowns that is equivalent to the system of linear equations 
Ax=b, the coefficient matrix C consisting of elements of n rows 
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and n columns and the constant vector d consisting of n elements, 
wherein the coefficient matrix A is triangular transformed into 
the coefficient matrix C of upper triangular form without 
diagonal elements of the coefficient matrix A being changed to 1; 
a diagonal element inverting unit for calculating inverses of 
diagonal elements of the generated coefficient matrix C on the 
finite field GF (p) ; and an equation computing unit for solving 
the system of linear equations Cx=d using the coefficient matrix 
C, the constant vector d, and the inverses of the diagonal 
elements of the coefficient matrix C, to thereby solve the system 
of linear equations Ax=b. 

With this construction, the system of linear equations can 
be solved with reduced computational complexity. 

Here, the triangular transforming unit may perform one or 
more successive transformation processes to generate the 
coefficient matrix C and the constant vector d of the system of 
linear equations Cx=d from the coefficient matrix A and the 
constant vector b of the system of linear equations Ax=b, wherein 
in each transformation process the triangular transforming unit 
transforms a coefficient matrix and a constant vector of a system 
of linear equations in n unknowns, into a coefficient matrix and 
a constant vector of a system of linear equations in n unknowns 
that is equivalent to the system of linear equations before the 
transformation, where the system of linear equations Ax=b is 
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subjected to the first transformation process and the system of 
linear equations Cx=d is generated as a result of the last 
transformation process, wherein in each transformation process 
the system of linear equations in n unknowns that is subjected to 
the transformation includes one pivotal equation which is a 
linear equation serving as a pivot for the transformation and one 
or more object equations which are linear equations to be 
transformed, and the triangular transforming unit transforms each 
of the object equations into an equation equivalent to the object 
equation by defining a first coefficient group containing at 
least one value related to the pivotal equation and a second 
coefficient group containing n+1 values related to the pivotal 
equation, changing a nonzero coefficient in the object equation 
to 0, multiplying each of a constant and n coefficients in the 
object equation by the value in the first coefficient group, and 
subtracting the n+1 values in the second coefficient group 
respectively from the n+1 multiplication results. 

With this construction, the triangular transformation is 
carried out without the diagonal elements of the coefficient 
matrix of the system of linear equations being converted to 1. 

Here, each transformation process may have transformation 
subprocesses each for transforming a separate one of the object 
equations, wherein in each transformation subprocess the 
triangular transforming unit (a) chooses a nonzero coefficient 
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from the pivotal equation and sets the chosen nonzero coefficient 
into the first coefficient group, (b) chooses a nonzero 
coefficient from the object equation, multiplies each of a 
constant and n coefficients in the pivotal equation by the 
nonzero coefficient chosen from the object equation, and sets n+1 
values obtained by the multiplications into the second 
coefficient group, (c) changes the chosen nonzero coefficient in 
the object equation to 0, and (d) multiplies each of a constant 
and n coefficients in the object equation by the nonzero 
coefficient in the first coefficient group, and subtracts the n+1 
values in the second coefficient group respectively from the n+1 
multiplication results . 

Here, each transformation process may have a coefficient 
group calculation process and transformation subprocesses, 
performed following the coefficient group calculation process, 
each for transforming a separate one of the object equations, 
wherein in the coefficient group calculation process the 
triangular transforming unit (a) chooses m nonzero coefficients 
by taking one nonzero coefficient from each of the pivotal 
equation and the object equations, multiplies each combination of 
(m-2) of the chosen nonzero coefficients, and sets the m 
multiplication results into the first coefficient group, m being 
a positive integer no smaller than 2, and (b) multiplies each of 
a constant and n coefficients in the pivotal equation by a 
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multiplication result in the first coefficient group for a 
combination of nonzero coefficients that does not include a 
nonzero coefficient chosen from the pivotal equation, and sets 
n + 1 values obtained by the multiplications into the second 
coefficient group, and wherein in each of the transformation 
subprocesses following the coefficient group calculation process, 
the triangular transforming unit (a) changes a nonzero 
coefficient chosen from the object equation in the coefficient 
group calculation process, to 0 in the object equation, and (b) 
multiplies each of a constant and n coefficients in the object 
equation by a multiplication result in the first coefficient 
group for a combination of nonzero coefficients that does not 
include the nonzero coefficient chosen from the object equation, 
and subtracts the n+1 values in the second coefficient group 
respectively from the n+1 multiplication results. 

With these constructions, the equivalent system of linear 
equations can be obtained through the. triangular 
transformation. 

Here, when the diagonal elements of the coefficient matrix 
C are denoted by jn i (i=l ,2, . . . ,n) and the inverses of the 

diagonal elements m. (i=l,2, ,n) in the finite field GF (p) are 

denoted by I ± (1=1,2 , ... ,n) , the diagonal element inverting unit 
may include (a) a multiplying unit for computing 



23 



k=l 

and 



t i =Jjm k (except m.) mod p (i=l , 2 , . . . ,n) 



t= ll m k nodp 

k=l 



(b) a first inverting unit for computing 
u=l/t mod p 

and (c) a second inverting unit for computing 
5 I i =u^t i mod p (i=l ,2 , . . . ,n) 

*Z to find the inverses I £ (i=l ,2, . . . ,n) . 

f=i Here, the multiplying unit may calculate 

ffi s 1 -m 1 ^m 2 mod p 

ffi s 2 =s 1 xm 3 mod p 

103 

Sn-3= S n-4 Xm n-2 m ° d P 

53 in the stated order, then calculate 

3 : 
■s » 

fc„-i=s„-3 xm n mod p 

15 S n =m n-1 * m n mo< ^ P 

s n . 1 =m n . 2 ^s n mod p 





t„-3=Sn-5 XS n -l 


mod p 




S n-2 =m n -3* S n-l 


mod p 


20 


t n -4 =S n-6 XS n-2 


mod p 
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s 5 =m 4 *s 6 mod p 
t 3 =s 1 *s 5 mod p 
s 4 =m 3 xs 5 mod p 
t 2 =m 1 xs 4 mod p 
t 1 =m 2 *s 4 mod p 
in the stated order, and lastly calculate 
t=t^m. 

for a value j chosen from a set of positive integers 
{ 1 ,2 , . . . ,n} . 

With these constructions, the number of inverse operations 
needed to compute the inverses of the diagonal elements can be 
reduced. 

As a result, overall computational complexity of the 
apparatus for solving a system of equations on a finite field is 
reduced. Such an apparatus bears high practical value, as it 
enables high-speed cryptographic or digital signature 
processing. 

The above object can also be achieved by an apparatus for use 
in encryption or decryption, for computing an inverse I of an 
element y in GF(q) which is an extension field of a finite field 
GF(p) f where p is a prime, q=p n , and n is a positive integer, the 
apparatus including: an equation generating unit for generating 
a coefficient matrix A and a constant vector b for a system of 
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linear equations Ax=b in n unknowns, using the element y and all 
coefficients of a generator polynomial of GF(q) whose root is. a; 
an equation solving unit for finding solutions of the system of 
linear equations Ax=b, the equation solving unit including the 
above apparatus for solving the system of linear equations Ax=b; 
and an inverse computing unit for computing the inverse I using 
the root a and the solutions found by the equation solving 
unit. 

With this construction, the inverse of the extension field 
element can be computed with reduced computational complexity. 

The above object can also be achieved by a record medium 
reproducing apparatus for computing, when copyrighted digital 
content has been encrypted using a discrete logarithm problem on 
an elliptic curve E over GF(q) as a basis for security and 
recorded on a record medium, an inverse J of an element y in 
GF(q) to decrypt the encrypted digital content recorded on the 
record medium, where GF ( q) is an extension field of a finite 
field GF(p), p is a prime, q=p n ', n is a positive integer, and G 
is a base point of the elliptic curve E, the record medium 
reproducing apparatus including: an equation generating unit for 
generating a coefficient matrix A and a constant vector b for a 
system of linear equations Ax=b in n unknowns, using the element 
y and all coefficients of a generator polynomial of GF (q) whose 
root is a; an equation solving unit for finding solutions of the 
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system of linear equations Ax=b f the equation solving unit 
including the above apparatus for solving the system of linear 
equations Ax=b; and an inverse computing unit for computing the 
inverse J using the root a and the solutions found by the 
equation solving unit. 

With this construction, the record medium reproducing 
apparatus can compute the inverse of the extension field element 
with reduced computational complexity. 

BRIEF DESCRIPTION OF THE DRAWINGS 

These and other objects, advantages and features of the 
invention will become apparent from the following description 
thereof aken in conjunction with the accompanying drawings that 
illustrate a specific embodiment of the invention. In the 
drawings : 

Fig. 1 is a block diagram showing the construction of an 
inversion apparatus 100 according to an embodiment of the 
invention; 

Fig. 2 is a flowchart showing the general operation of the 
inversion apparatus IOC- 
Fig. 3 is a flowchart showing the operation of triangular 
transforming a coefficient matrix of a system of equations by an 
equation transforming unit 102 in the inversion apparatus IOC- 
Fig. 4 is a flowchart showing the operation of inverting 
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diagonal elements of the coefficient matrix in the inversion 
apparatus 100; 

Fig. 5 is a flowchart showing the operation of solving the 
system of equations in the inversion apparatus 100; 

Fig. 6 shows an example of the triangular transformation by 
the equation transforming unit 102; 

Fig. 7 is a flowchart showing the operation of triangular 
transforming a coefficient matrix by an equation transforming 
unit 102a as a variant of the invention; 

Fig. 8 shows an example of the triangular transformation by 
the equation transforming unit 102a; 

Fig. 9 is a sequential view showing the procedure of the 
conventional ElGamal digital signature scheme; 

Fig. 10 is a flowchart showing the conventional triangular 
transformation of a coefficient matrix; and 

Fig. 11 shows an example of the conventional triangular 
transformation. 

DESCRIPTION OF THE PREFERRED EMBODIMENT ( S ) 
1 . Embodiment 

The following is a description of an inversion apparatus 100 
according to an embodiment of the present invention. 
1,1. Construction of the Inversion Apparatus 100 

The inversion apparatus 100 computes the inverse I of an 
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element x on GF(q) (q=p n , p a prime, n a positive integer) which 
is an extension field of a predetermined finite field GF(p) . In 
this embodiment, a generator polynomial of the extension field 
GF(q) is g n -f3 whose root is a, and the element x is such that 
x=x 0 +x 2 a+- • -+x n _ 1 d 1 ' 1 , where a is an element of GF(q) and J3, x 0 , x x , 
. . . , x n _ 1 are elements of GF(p) , 

As shown in Fig. 1, the inversion apparatus 100 is roughly 
made up of a parameter storing unit 200, an equation generating 
unit 201, an equation solving unit 202, an inverse computing unit 
203, and an inverse storing unit 204. 

Specifically, the inversion apparatus 100 is implemented by 
a computer system equipped with a microprocessor, a ROM, a RAM, 
a hard disk, and the like. Through execution of a computer 
program stored in the hard disk by the microprocessor, the 
equation generating unit 201, the equation solving unit 202, and 
the inverse computing unit 203 are realized. 

(1) Parameter Storing Unit 200 

The parameter storing unit 200 is implemented by the hard 
disk. The parameter 0 of the generator polynomial, the root a, 
and the elements x Q9 x 2 , ... , x n _ x are stored in the parameter 
storing unit 200 beforehand. 

(2) Equation Generating Unit 201 

The equation generating unit 201 reads /?, a, x Q9 x lf ... , x n _ 1 
from the parameter storing unit 200, and generates parameters of 
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the following system of equations of y i (1=0 , 1 ,2 t 

x 0 y 0 +Pxn-iyi + P x n- 2 y 2 + • • • +0 x iy n -i =1 
x&o +x 0 yi +P x n -iy 2 + ' • • + &* 2 y n -i =0 

X 2 y 0 +XlYl + X 0 y 2 +— '+P X 3Yn-l =0 



,n-l) 



x n-iy 0 +x n - 2 yi +x n-3y 2 + • • • +x 0 y n -i= 0 

using the read values. 

This system of equations can be written simply as 

AY=B 

where A is a matrix and Y and B are vectors such that 



A = 



X 0 P X n-l & X n- 



P X n-l 



\ 



X n-1 X n-2 X n-3 



/3x 3 



7 



Y= 



y 0 
y 2 
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The parameters of the system of equations generated by the 
equation generating unit 201 are the matrix A and the vector B. 
The equation generating unit 201 outputs the generated matrix A 
and vector B to the equation solving unit 202. 

The equation generating unit 201 also outputs a read from the 
parameter storing unit 200 , to the inverse computing unit 203. 
(3) Equation Solving Unit 202 

The equation solving unit 202, when given parameters a ±j 
(i,j=l,2, . . . ,n) and b k (k=l ,2, . . . ,n) of the following system of 
linear equations in n unknowns for x i (i=l ,2 , . . . ,n) on a 
predetermined finite field GF (p) (p a prime) , solves the system 
of linear equations in n unknowns on GF (p) . 

*ll X l+ a i2 X 2+' ' m + a in X n =1:> l 

a 21 x 2 +a 22 x 2 + • • * +a 2n x r rb 2 

The equation solving unit 202 includes a constant storing 
unit 101, an equation transforming unit 102, an inverting unit 
103, and an equation computing unit 104, as shown in Fig. 1. 
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(Constant Storing Unit 101) 

The constant storing unit 101 is implemented by the RAM- The 
constant storing unit 101 receives a matrix M and a vector v from 
the equation generating unit 201 and stores them. Here, the 
matrix M and the vector v are respectively 



/ 



M= 



a il a i2 



3 21 a 22 



a nl a n2 



'In 



*2n 



\ 



b l 



For example, the matrix M is the matrix A and the vector v 
is the vector B. 

(Equation Transforming Unit 102) 

The equation transforming unit 102 reads the matrix M and the 
vector v from the constant storing unit 101 and triangular 
transforms the read matrix M and vector v, to generate a matrix 
M f (a coefficient matrix consisting of n rows and n columns) and 
a vector v' (a constant vector consisting of n elements) for a 
system of linear equations M r x=v' in n unknowns that is 



32 



equivalent to a system of linear equations Mx=v in n unknowns. 

In the triangular transformation, the equation transforming 
unit 102 transforms the matrix M into an upper triangular matrix 
without changing each diagonal element of the matrix M to 1. 

Such generated matrix M f and vector v' are 



/ 



C ll C 12 



C 21 C 22 



<=nl C n2 



\ 



'In 



'2n 



\ 



J 




This triangular transformation is carried out in the 
following way. 

In the triangular transformation, one or more successive 
transformation processes are performed to generate the matrix M' 
and vector v' of the system of linear equations M'x=v' from the 
system of linear equations Mx=v. 

In each transformation process, the equation transforming 
unit 102 generates, from a system of linear equations in n 
unknowns, a coefficient matrix and a constant vector for a system 
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of linear equations in n unknowns that is equivalent to the 
system of linear equations before the transformation. In this 
embodiment, a system of linear equations in n unknowns that is 
subjected to the initial transformation process is the system of 
linear equations Mx=v, whereas a system of linear equations in n 
unknowns that is obtained as a result of the last transformation 
process is the system of linear equations M'x=v'. 

In each transformation process, a system of linear equations 
in n unknowns before the transformation includes one linear 
equation as a pivotal equation serving as the transformation 
pivot and one or more linear equations as object equations to be 
transformed. 

Each transformation process has transformation subprocesses 
as many as the object equations in the system of linear 
equations, each for transforming a separate one of the object 
equations to an equation equivalent to the object equation. 
Before transforming the object equation to the equivalent 
equation, a first coefficient group and a second coefficient 
group are defined in each transformation subprocess. 

The first and second coefficient groups are each a group that 
contains at least one value related to the pivotal equation. To 
be more specific, the equation transforming unit 102 sets one 
nonzero coefficient of the pivotal equation into the first 
coefficient group. Also, the equation transforming unit 102 
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multiplies each of a constant and n coefficients of the pivotal 
equation by one nonzero coefficient of the object equation, and 
sets n+1 values obtained as a result into the second coefficient 
group. 

Following this, the equation transforming unit 102 changes 
the nonzero coefficient of the object equation to 0. The 
equation transforming unit 102 then multiplies each of a constant 
and n coefficients of the object equation by the value in the 
first coefficient group, and subtracts the n+1 values in the 
second coefficient group respectively from the n+1 multiplication 
results. In so doing, the object equation is transformed into 
the equivalent equation where one of its nonzero coefficients has 
become 0. 

This triangular transformation will be explained in greater 
detail later. 

The equation transforming unit 102 outputs the generated 
matrix M' and vector v' to the equation computing unit 104, and 
outputs the diagonal elements c ±i (i=l ,2 , . . . ,n) of the matrix M' 
to the inverting unit 103. 

As described earlier, when transforming the matrix M into 
upper triangular form, the equation transforming unit 102 also 
transforms the vector v so as not to alter the solutions of the 
system of linear equations Mx=v. The difference with the 
conventional triangular transformation lies in that the diagonal 
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elements of the matrix M are not converted to 2. 
(Inverting Unit 103) 

The inverting unit 103 receives the diagonal elements c ii 
(i=l,2, . . . ,n) of the matrix M' from the equation transforming 
unit 102. 

For simplicity's sake, the diagonal elements c JJ 
(i=l,2, . . . ,n) of the matrix M' are expressed as m. (i=l ,2 , . . . ,n) 
here . 

The inverting unit 103 solves 

t i =fjm k (except m ± ) mod p (i=l ,2 , . . . ,n) 

k=l 



by first calculating 

s 1 -m 1 xm 2 mod p 

s 2 =s i xm 3 mod P 



Sn-3 =S n-4 Xm n-2 m ° d P 
tn= S n-3* m n-l m ° d P 
^-l =S n-3 Xjn n m ° d P 

S n =sm n-l XItl n m ° d P' t n-2 =S n-4 XS n m ° d P 

S n-l =m n-2 XS n m ° d P' t n-3 =S n-5 X S n-1 m ° d P 

S n-2 =m n-3 XS n-l m ° d P' t n-4= S n-6 XS n^2 m ° d P 

s 5 =m 4 *s 6 mod p, ^3 =s i xs s mod P 



36 



s 4 =m 3 *s 5 mod p, t 2 =m 1 xs 4 mod p 

t 1 =m 2 *s 4 mod p 

in this order. The inverting unit 103 then calculates 
t=t k *m k mod p 

using a predetermined value k (chosen from a set of positive 
integers {1, 2, . .. , n}) , and thereby solves 

n 

t=JJm ± mod p 

The inverting unit 103 next computes 
u=l/t mod p 

and finally obtains the inverses I ± (1=1 ,2 , . . . ,n) by 
J i =uxt i mod p (i=l ,2 , . . . ,n) 

The inverting unit 103 outputs the inverses I ± (i=l ,2 , . . . ,n) 
to the equation computing unit 104. 

Thus, the inverting unit 103 computes, on GF(p), the inverses 
I. (1=1,2, ... ,n) of the diagonal elements c u (i=*l ,2, . . . ,n) of the 
matrix M f which are given from the equation transforming unit 
102. 

(Equation Computing Unit 104) 

The equation computing unit 104 receives the matrix M r and 
the vector v r from the equation transforming unit 102, and also 
receives the inverses I x (1=1 ,2 , . . . ,n) from the inverting unit 
103. 
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The equation computing unit 104 sets the values n-1, n-2, . . . 
, 2, l f 0 in counter j one at a time. For counter j, the 
equation computing unit 104 uses the matrix M' , the vector v', 
and the inverses J_. (±=1,2, . . . ,n) to compute 

yj =I i+i xd 3+i mod P 
when j=n-l, and compute 

when 

The equation computing unit 104 then outputs the solutions 
y. (j=0,l,2,...,n-l) to the inverse computing unit 203. 

The reason that the solutions of the system of linear 
equations in n unknowns can be found by the equation computing 
unit 104 is shown below. 

Since the matrix M' received from the equation transforming 
unit 102 is an upper triangular matrix, the system of linear 
equations M'x=v' can be written as 

CllX 0 + C 12 X l+ C 13 X 2+' * '+ C ln X n-l= d X 

<=nn X n-l =d n 

with the inverses of the diagonal elements c ii (±=1 ,2 , . . . ,n) 
of the matrix M r being I i (1=1 ,2, . . . ,n) . 



38 



Accordingly, the solution y n _ 2 of x,,^ is 

Yn-l-Indn-l m ° d P 

the solution y n _ 2 of x n _ 2 is 

and the solutions y i (j=n-3,n-4,...,0) of x^. are 
Y 3 =Ij .! * (d, +1 ~ n 'E c 1± ^y L ) mod p 

(4) Inverse Computing Unit 203 

The inverse computing unit 203 receives the solutions y j 
(j=0 ,1 ,2 , . . . f n~l) from the equation computing unit 104 in the 
equation solving unit 202, and receives the root a from the 
equation generating unit 201. The inverse computing unit 203 
calculates the inverse J according to the equation 

I=Yo + Yi a + ' ' * + Yn-i 0/7-1 
using the received solutions (j=0,l,2,...,n-l) and root a. 

The inverse computing unit 203 writes the calculated inverse I 

into the inverse storing unit 204. 

Hence the inverse I of the element x in the extension field 

GF(q) is obtained. 

(5) Inverse Storing Unit 204 

The inverse storing unit 204 is implemented by the hard disk 
and stores the inverse J of the element x of the extension field 
GF(q) . 
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1.2, Ope^tion of the inversion Apparatus 1QQ 

The following is a description on the operation of the above 
constructed inversion apparatus 100. 

(1) General Operation of the Inversion Apparatus 100 
5 The general operation of the inversion apparatus 100 is 

explained below with reference to Fig. 2. 

The equation generating unit 201 reads the parameter fi, the 

root a, and x Q , x lf . . . , x n _ 2 from the parameter storing unit 200 , 

and uses them to generate the matrix A and the vector B as the 
l62 parameters of the system of linear equations AY=B in n unknowns 

JL; for y i (i=0,l,2, . . . ,n-l) . The equation generating unit 201 

'it outputs the generated matrix A and vector B to the constant 

storing unit 101 in the equation solving unit 202, and outputs 

r=i the root a to the inverse computing unit 203 (S101) . 

p % 

Ipy The equation transforming unit 102 in the equation solving 

C3 unit 202 reads the matrix M and the vector v from the constant 

storing unit 101 and triangular transforms the read matrix M and 
vector v, as a result of which the matrix M' and the vector v' 
for the system of linear equations M'x=v r in n unknowns, that is 

20 equivalent to the system of linear equations Mx=v, are generated 

(S102) . 

The inverting unit 103 in the equation solving unit 202 
calculates the inverses (i=l,2, . . . ,n) of the diagonal elements 
c ±± (i=l,2, ... ,n) of the matrix M' (S103) . 
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The equation computing unit 104 in the equation solving unit 
202, through the use of the matrix M' , the vector v r , and the 
inverses I\ (i=l f 2, . . . , n) , seeks the solutions y j (j=0,l,2,..., 
n-1) of the system of linear equations M'x=v', and outputs the 
solutions y j (j=0 ,1 ,2 , . . . ,n-l) to the inverse computing unit 203 
(S104). 

The inverse computing unit 203 receives the solutions y j 
(j=0,l,2,...,n-l) from the equation computing unit 104 and the 
root a from the equation generating unit 201, finds the inverse 
I of the element x in the extension field GF(q) using the 
received solutions and root, and writes the inverse J into the 
inverse storing unit 204 (S105) . 

(2) Operation of Triangular Transformation by the Equation 
Transforming Unit 102 

The operation of the triangular transformation by the 
equation transforming unit 102 is explained in detail below with 
reference to Fig. 3.. 

The equation transforming unit 102 reads the matrix M and the 
vector v from the constant storing unit 101 (Sill) , and sets 
counter j at 1 (S112) . 

The equation transforming unit 102 searches the jth column 
of the matrix M from the jth to nth rows for an element which is 
not 0 on GF(p), and sets the row number of a nonzero element 
found first as k (S113) . Here, if k*j (S114), the equation 
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transforming unit 102 changes places between the kth row and the 
jth row in the matrix M (S115) , and changes places between the 
kth row and the jth row in the vector v (S116) . 

The equation transforming unit 102 sets counter i at j+1 
(S117), and makes the following settings using a jj (the element 
in the jth row and jth column of the matrix M) and a ±j i 

a . .=0 

a ik =a jj a ik~ a ij a jk for (k=j+l ,j+2 , . . . ,n) 

h i =a jj h i' a ±j h 3 

(S118) . 

The equation transforming unit 102 then judges whether i=n 
(S119) . If i*n, the equation transforming unit 102 increments 
counter i by 1 (S122) and returns to step S118. If i=n, the 
equation transforming unit 102 judges whether j=n-l (S120) . If 
j*n-l, the equation transforming unit 102 increments counter j by 
1 (S123) and returns to step S113. If j=n-l, the equation 
transforming unit 102 sets the matrix M as the matrix M' and the 
vector v as the vector v r , and completes the operation. 

As described above, this triangular transformation includes 
transformation processes which correspond to the separate values 
of counter j, and each of the transformation processes includes 
transformation subprocesses which correspond to the separate 
values of counter i. 

(Reason for Equivalence between Mx=v and M'x=v r ) 
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The reason why the system of linear equations M'x=v' 
generated as a result of the triangular transformation by the 
equation transforming unit 102 is equivalent to the system of 
linear equations Mx=v is given below. 

In each transformation process of the triangular 
transformation, let M in and v in be a matrix and a vector before the 
transformation, M ovt and v 0(/t be a matrix and a vector after the 
transformation, and L ± and L j be the ith and jth row vectors of 
the matrix M in . 

The equation transforming unit 102 calculates 
a jj xL 1 -a ij xL j 

and, having set the resulting row vector as the ith row of 
the matrix M out , calculates 

a jj xb.-a lj xb j 

the outcome of which is set as the ith row of the vector v out . 
The other elements of M out and the other elements of v out are 
respectively equal to the other elements of M in and the other 
elements of v in . This being the case, the system of linear 
equations 

and the system of linear equations 
M *x=v 

* J out v out 

have the same solutions, as demonstrated in document 2, 
Also, the equation transforming unit 102 defines a i:f .=0 for 
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every i that satisfies j+l<;i<m. Repeating this process from j=l 
to j=n renders all elements in the lower triangle of the matrix 
0. Thus, the matrix can be triangular transformed without the 
solutions of the system of linear equations being altered. 

(3) Operation of the Inverting Unit 103 

The operation of the inverting unit 103 is explained in 
detail below with reference to Fig. 4. 

The inverting unit 103 receives the diagonal elements m. ( 
i=l,2 , . . . ,n) of the matrix M' from the equation transforming unit 
102 (S141), and computes 

n 

t i =JJm k (except mod p (i=l ,2 , . . . ,n) 

k=l 

(S142) . The inverting unit 103 then computes 
t=t k *m k mod p 

using the predetermined value k (S143), and also computes 
u=l/t mod p 

(5144) . The inverting unit 103 finally finds the inverses 

J i =uxt i mod p ,2 , . . . ,n) 

(5145) , and outputs the inverses I ± (i=l ,2 , . . . ,n) to the 
equation computing unit 104 (S146) . 

(4) Operation of the Equation Computing Unit 104 

The operation of the equation computing unit 104 is explained 
in detail below with reference to Fig. 5. 
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The equation computing unit 104 receives the matrix M' and 
the vector v' from the equation transforming unit 102, and 
receives the inverses X i (i=l ,2, . . . ,n) from the inverting unit 
103 (S161) . Having set counter j at n-2 (S162), the equation 
computing unit 104 computes 

Yj =I i+i xd i+i mod P 
when j=n-l, and computes 

n-l 

Yj =Ij +! * (d 3 -E +i S i +i *Y±) mod P 
when j*n-l (S163) . 

The equation computing unit 104 judges whether j=0 (S164) • 
If j=0, the equation computing unit 104 outputs the solutions y j 
(j=0 ,1 ,2 , . . . ,n-l) to the inverse computing unit 203 (S166) . 
Otherwise, the equation computing unit 104 decrements counter j 
by 1 (S165) and returns to step S163. 
l„3 f Computatioyial Complexity 

The computational complexity of the equation solving unit 202 
is evaluated below. 

(1) Computational complexity of the Equation Transforming Unit 
102 

In the equation transforming unit 102, computational 
complexity for one value of counter j (steps S113-S119 in Fig. 3) 
is the following. 
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First, computational complexity for one value of counter i 
(step S118) is broken down as shown below. 

(a) In step S118, the calculation a i k =a jj xa i k " a ±j xa jk ^ s 



multiplications are repeated (n- (j+1) +1) = (n-j ) times, so that 
computational complexity is (2* (n-j) )Mul . 

(b) In step S118, the calculation b^a^xb^a^x^ involves two 
multiplications, so that computational complexity is 2Mul. 

Since counter i changes from j+1 to n, the computational 
complexity of steps S113-S119 for one value of counter j is 



In steps S112-S120, counter j changes from 1 to n-1, so that 
the overall computational complexity of the equation transforming 
unit 102 is 



performed for j+lxk^n (k=j+l ,j+2 



n) . 



This means two 



(2* (n-j+1) )Mul x (n- +1) 



= (2* (n-j) * (n-j+1) )Mul 




3=1 j=l 



=2Mul* (l/6*n(n-l) (2n-l) +l/2*n(n-l) ) 



=2Mulxl/6*n(n-l) (2n-l+3) 



=l/3Mul *n (n -1) (2n +2) 



= (2/3x n (n-1) (n+l))Mul 
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(2) Computational Complexity of the Inverting Unit 103 

The computational complexity of the inverting unit 103 can 
be broken down as follows. 

(a) Finding s^s^ and t n requires n-2 multiplications, so 
that computational complexity is (n-2) Mul . 

(b) Finding t n _ 2 requires one multiplication, so that 
computational complexity is IMul. 

(c) Finding s n and t n _ 2 , s n _ 2 and t n _ 3 , . . . , and s 4 and t 2 
requires 2* (n-3) multiplications, so that computational 
complexity is (2 * (n-3) ) Mul . 

(d) Finding t 2 requires one multiplication, so that 
computational complexity is IMul. 

(e) Finding t requires one multiplication, so that 
computational complexity is IMul. 

(f) Finding u=l/t mod p requires one inversion, so that 
computational complexity is 2 In v. 

(g) Finding J i =uxt i mod p (i=l ,2 , . . . ,n) requires n 
multiplications, so that computational complexity is nMul. 

Summing these computational complexity gives the total 
computational complexity of the inverting unit 103 as 

( (n-2) +1+2 (n-3) +l+l+n) Mul+llnv 
= (4n-5)Mul+lInv 

(3) Computational Complexity of the Equation Computing Unit 104 

In the equation computing unit 104, computational complexity 
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for one value of counter j (steps S163-S165 in Fig. 5) is as 
follows . 

To compute 

when j=n-l and 

n-l 

yj =i j * * (d j *i c j +1 1 +i y i } mod p 

when j*n-l, one multiplication and (n-(j+l)+l) 
multiplications are needed, which makes the computational 
complexity of (n-j+1) Mul . 

Since counter j changes from 1 to n, the total computational 
complexity of the equation computing unit 104 is 

n 

(n-j +l)Mul 
= (l/2xn (n +l))Mul 

(4) Total Computational Complexity of the Equation Solving Unit 
202 

From the foregoing description, the total computational 
complexity of the equation solving unit 202 is given by 

(2/3*n(n-l) (n+l))Mul 
+ (4n-5)Mul+lInv 
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+ (l/2*n (n+1) )Mul 
= (1/6 (4n 3 +3n 2 +23n-30) )Mul+lInv 
Supposing Unv=40Mul in a general-purpose . computer when n=5 
and \q\=160 (|g| is the bit size of g) , the total computational 
complexity of the equation solving unit 202 can be estimated at 
150Mul. 

Thus, the computational complexity of the equation solving 
unit 202 of the invention is much smaller than that of the prior 
art. Such an equation solving unit bears huge practical value, 
as it enables an apparatus to solve a system of equations on a 
finite field with reduced computational complexity. 

Also, such an equation solving unit enables an apparatus to 
compute an inverse I of an element x in an extension field GF(q) 
of a predetermined finite field GF (p) with reduced computational 
complexity. 
1.4. Concrete Example 

The following is a concrete example of the operation of the 
equation solving unit 202 . 

As with the prior art 3, a prime p=31, a generator polynomial 
f(g)=g 5 -2, and an element x=5ct +29cl + 6d +19a+l7 of GF(q) are given. 
A system of equations to be solved is the same as that in the 
prior art 3, as shown in Fig. 6(a). 

The following calculations are performed: 
a 21 =0 
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a 22 =17xl7-19*10=6 mod 31 
a 23 =17 'xl0-19*27=29 mod 31 
a 24 =17*27-19*12=14 mod 31 
a 25 =17*12-19x7=9 mod 31 
b 2 =17*0-19*l=12 mod 31 
When j=l (i=2) , the system of equations is transformed as 
shown in Fig. 6(b). Here, the element in the first column and 
second row has become 0 in a coefficient matrix 411. 

As a result of the transformation process for j=l, the system 
of equations has become as shown in Fig. 6(c), where the elements 
in the first column and third to fifth rows are 0 in a 
coefficient matrix 421. 

As a result of the transformation process for j=2, the system 
of equations has become as shown in Fig. 6(d), where the elements 
in the second column and third to fifth rows are 0 in a 
coefficient matrix 431. 

As a result of the transformation process for j=3, the system 
of equations has become as shown in Fig. 6(e), where the elements 
in the third column and fourth to fifth rows are 0 in a 
coefficient matrix 441. 

As a result of the transformation process for j=4, the system 
of equations has become as shown in Fig. 6(f), where the element 
in the fourth column and fifth row is 0 in a coefficient matrix 
451. 
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Next, the diagonal elements in the coefficient matrix 451 are 
inverted by calculating 

s 2 =m 1 *m 2 =l 7 * 6=3 mod 31 
s 2 =s x xm 3 =9 x 1 7=29 mod 31 
5 t s =s 2 *m 4 =29x6=19 mod 31 

t 4 =s 2 xm 5 =2 9x30=2 mod 31 
s 5 =m 4 xm 5 =6x30=25 mod 31 

t 3 =s 1 xs 5 =9x25=8 mod 31 
s 4 =m 3 xs 5 =l 1x25=22 mod 31 
l&i t 2 =m 1 *s 4 =17x22=2 mod 31 

= : : 

t 1 =m 2 xs 4 =6 x22=8 mod 31 
jn t=m l xt 1 =17*8=12 mod 31 

% u=l/t=l/12=13 mod 31 

C3 I 1 =uxt 1 =13x8=ll mod 31 

Iffy I 2 =uxt 2 =13*2=26 mod 31 

J3 I 3 =uxt 3 =13 x8=ll mod 31 

I 4 =uxt 4 =13x2=26 mod 31 
I 5 =uxt 5 =13xl9=30 mod 31 
Notice that u=l/t=l/12=13 mod 31 is the only inverse 
20 operation here. 

Lastly, the system of equations is solved in the following 

way: 

y 4 =I 5 xd 5 =30*2=29 mod 31 
Y 3 = I 4 X (d 4 -c 45 xy 4 ) 
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=26* (28-2*29) =26 mod 31 
y 2 =I 3 * (d 3 -c 34 *y 3 -c 35 xy 4 ) 

=11* (1-6*26-11x29) =25 mod 31 

Yl = I 2 X ( d 2- C 23 X Y 2 - C 24 X y3- C 25 X y4) 

=26* (12-29*25-14*26-9x29) 
=25 mod 31 

Y 0 =I l X < d l ~ C 12 X Yl ~ C 13 X Y 2 - C 14 X y 3 - C 15 X Y 4 > 

=11 * (1-10*25-27*25-12*26-7*29) 
=12 mod 31 

1,5, Applications 

In application of the present invention to an actual 
communication system such as a cryptographic communication 
system, a digital signature communication system, or an error 
correction communication system, parameters such as follows are 
used. 

For a prime jp=2 3l -l,* q=p n , n=5, a generator polynomial 
f (g) ss g 5 -g-8, and an element x=x Q +x 1 *a+x 2 *c?+x 3 *c?+x 4 *a 4 of GF(q), a 
system of equations is defined as 



8x. 



8x, 



8x, 



Sx, 



~0 3 ""1 

x 1 x Q +x 4 x 3 +8x 4 x 2 +8x 3 x x +8x 2 

x 2 x x x 0 +x 4 x 3 +8x 4 x 2 +8x 3 

x 3 x 2 x 2 x 0 +x 4 x 3 +8x 4 



' y 0 

y 2 
y 3 



\ 



X 0 +X 4 



0 
0 
0 
0 

A J 
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where p, x 0 , ... , x 4 , and y 0 , ... , y 4 are each 32 bits long, 
and q and x are each 155 bits long. 
2. Modifications 
2.1. Variant 

5 As a variant of the equation transforming unit 102 in the 

equation solving unit 202, an equation transforming unit 102a is 
explained below. 

In the equation transforming unit 102a, each transformation 
process has one coefficient group calculation process and 
10S subsequent transformation subprocesses as many as object 

!*j equations, each for transforming a separate one of the object 

tfl equations. 

* . s 

jfl In the coefficient group calculation process, the equation 

C3 transforming unit 102a chooses m nonzero coefficients by taking 

lBU one nonzero coefficient from each of the pivotal equation and the 

£3 object equations in the coefficient matrix consisting of n rows 

and n columns, multiplies each combination of (m-1) of the chosen 
nonzero coefficients, and sets the m multiplication results into 
a first coefficient group. The equation transforming unit 102a 
20 then multiplies each of a constant and n coefficients of the 

pivotal equation by the multiplication result in the first 
coefficient group for a combination of nonzero coefficients that 
does not include the nonzero coefficient of the pivotal equation, 
and sets n+1 values obtained as a result into a second 
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coefficient group . 

Following this, in each of the transformation subprocesses 
the equation transforming unit 102a changes a nonzero coefficient 
chosen from an object equation to 0, multiplies each of a 
constant and n coefficients of the object equation by the 
multiplication result in the first coefficient group for a 
combination of nonzero coefficients that does not include the 
nonzero coefficient of the object equation, and subtracts the n+1 
values in the second coefficient group respectively from the n+1 
multiplication results. 

The operation of the equation transforming unit 102a is 
explained below with reference to Fig. 7. The flowchart in Fig. 
7 includes steps S118a~S118c instead of step S118 in Fig. 3. 

Since the other steps are the same as those in Fig. 3, the 
following explanation will focus on steps S118a~S118c . 

In step S118a, the equation transforming unit 102a 
computes 

n 

h k =IJa mj (except a kj ) 

for each k that satisfies jgkzn (k=j f j+l , . . . ,n) . In step 
S118b, the equation transforming unit 102a computes 

w=h .xa.. 

k j jk 
D 3 
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for each k that satisfies j+l*k<?n (k=j+l ,j+2 , . . . ,n) . In step 
S118c, having set a iJ .=0 / the equation transforming unit 102a 
computes 

b i =h i xi^-e 

for each k that satisfies j+l^kzn (k=j+l f j+2 , . . . ,n) • 
(Concrete Example) 

An example of the operation of the equation transforming unit 
102a is shown below. 

As with the prior art 3, a prime p=31, a generator polynomial 
f(g)=g 5 -2, and an element x=5ce +29c? + 6d! +19a+ll of GF(q) are given. 
A system of equations to be solved is the same as that in the 
prior art 3, as shown in Fig. 8(a). 

When j=l, the equation transforming unit 102a calculates 
s 1 =a 11 xa 21 =17*19=13 mod 31 
s 2 =s 1 *a 31 =13 * 6=1 6 mod 31 
h 5 =s 2 xa 41 =16*29=30 mod 31 
h 4 =s 2 xa 51 =l 6x5=18 mod 31 
s 5 =a 41 xa 51 =29x5=21 mod 31 
h 3 =s x xs 5 =l 3 x 2 1=25 mod 31 
s 4 =a 31 xs 5 =6x21=2 mod 31 
h 2 =a n xs 4 =l 7x2=3 mod 31 
h 1 =a 21 xs 4 =19x2=7 mod 31 
and then calculates 
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w 2 =h 1 *a 12 =7 xl0=8 mod 31 
w 3 =h 1 xa 13 =7 *27=3 mod 31 
w 4 =h 1 xa 14 =7xi2=22 mod 31 
w 5 =h 1 *a 15 =7 *7=18 mod 31 
e=h x x J b I =7xl = 7 mod 31 

(j=l) , the equation transforming unit 102a 
a 2l =0 

a 22 =h 2 xa 22 -w 2 =3 x 1 7-8=12 mod 31 
a 23 =h 2 *a 23 -w 3 =3x 10-3=27 mod 31 
a 24 =h 2 xa 24 -w 4 =3 x2 7-22=28 mod 31 
a 25 =h 2 xa 25 -w 5 =3xl2-l 8=1 8 mod 31 
b 2 =h 2 xb 2 -e=3 x 0 - 7=2 4 mod 31 
According to this method, only one multiplication is needed 
to find a ik unlike the first embodiment which needs two 
multiplications, so that computational complexity is further 
reduced. 

With the above computations, the system of equations is 
transformed as shown in Fig. 8(b), where the element in the first 
column and second row has become 0 in a coefficient matrix 511. 

As a result of the transformation process for j=2, the system 
of equations has become as shown in Fig. 8(c), where the elements 
in the first column and third to fifth rows are 0 in a 
coefficient matrix 521. 
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When 1=2 
calculates 



Next, when 3=2, the equation transforming unit 102a 
calculates 

s i ===a 22* a 32 =1 2*2=24 mod 31 

h 5 =s 2 *a 42 =24 x 7=13 mod 31 

h 4 =s 1 *a 52 =2 4*25=11 mod 31 

s 4~ a 42 xa 52~7 *25=20 mod 31 

h 3 =a 22 *s 4 =12*20=23 mod 31 

h 2 =a 32 *s 4 =2*20=9 mod 31 
and then calculates 

w 3 =h 2 *a 23 =9 *2 7=2 6 mod 31 

w 4 =h 2 *a 24 =9x28=4 mod 31 

w 5 =h 2 x a 25 =9 xl8=7 mod 31 

e=h 2 xb 2 =9 x24=30 mod 31 
As a result of the transformation process for j=2 f the system 
of equations has become as shown in Fig. 8(d), where the elements 
in the second column and third to fifth rows are 0 in- a 
coefficient matrix 531. 

Next, when j=3, the equation transforming unit 102a 
calculates 

h 5 =a 33 *a 43 =8xl4=19 mod 31 
h 4 =a 33 xa 53 =8 xl2=3 mod 31 
h 3 =a 43 *a 53 =14 *12=13 mod 31 
and then calculates 

w 4 =h 3 xa 34 =13 xl=13 mod 31 
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w 5 =h 3 *a 35 =13 * 7=29 mod 31 
e=h 3 *b 3 =l 3*2 6=28 mod 31 
As a result of the transformation process for j=3, the system 
of equations has become as shown in Fig. 8(e), where the elements 
in the third column and fourth to fifth rows are 0 in a 
coefficient matrix 541. 

Next, when j=4, the equation transforming unit 102a 
calculates 

h 5 =a 44 =16 mod 31 
h 4 =a 54 =l 4 mod 31 
and then calculates 

w 5 =h 4 xa 45 =14*26=23 mod 31 
e=h 4 xb 4 =14*23=12 mod 31 
As a result of the transformation process for j=4, the system 
of equations has become as shown in Fig. 8(f), where the element 
in the fourth column and fifth row is 0 in a coefficient matrix 
551. 

Here, let C=A and D=B f and the diagonal elements are inverted 
by computing 

s 1 =m 1 *m 2 =l 7x12=18 mod 31 
s 2 =s 1 x m 3 =l 8x8=20 mod 31 
t 5 =s 2 xm 4 =20x 1 6=1 0 mod 31 
t 4 =s 2 xm 5 =20x22=6 mod 31 
s 5 =m 4 *m 5 =l 6*22=11 mod 31 
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t 3 =s 1 xs 5 =18*ll=12 mod 31 
s 4 =m 3 *s 5 =8 *11=26 mod 31 

t 2 =m 1 *s 4 =l 7x26=8 mod 31 
t 1 =m 2 xs 4 =12*26=2 mod 31 
t=m 1 xt 1 =17 x2=3 mod 31 
u=l/t=l/3=21 mod 31 
I 1 =uxt 1 =21*2=ll mod 31 
I 2 =uxt 2 =21 x8=13 mod 31 
I 3 =uxt 3 =21 xl2=4 mod 31 
I 4 =uxt 4 =2 1x6=2 mod 31 
I 5 =uxt 5 =21xiO=24 mod 31 
Notice that u=l/t=l/3=21 mod 31 is the only inverse operation 

Lastly, the system of equations is solved as follows: 
y 4 =I 5 xd 5 =24xl8=29 mod 31 
y 3 =I 4 x (d 4 -c 45 xy 4 ) 

=2x (23-26x29) =26 mod 31 
y 2 =I 3 x ( d 3 -c 34 xy 3 -c 35 xy 4 ) 

=4 x (26-1x26-7x29) =25 mod 31 
y 1 =I 2 x (d 2 -c 23 xy 2 -c 24 xy 3 -c 25 xy 4 ) 

=13x (24-27x25-28x26-18x29) 

=25 mod 31 
y 0 =I 1 x (d 1 -c 12 xy 1 -c 13 xy 2 -c 14 xy 3 -c 15 xy 4 ) 

=llx (1-10x25-27x25-12x26-7x29) 
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=22 mod 31 

(Computational Complexity of the Equation Transforming Unit 
102a) 

Computational complexity of the equation transforming unit 
102a for one value of counter j (steps S113-S119 in Fig. 7) is 
measured below. 

In step S118a, (3* (n-j+1) -6) multiplications are needed to 
find h k (k=j f j+l f . . . f n) , so that computational complexity is 
(3* (n-j+1) -6)Mul. 

In step 3118b, (n- (j+1) +1+1) multiplications are needed to 
find w k (k=j+l fj+2 , . . . ,n) and e, so that computational complexity 
is (n-j+l)Mul. 

In step S118c, for one value of counter i, computational 
complexity is as follows. 

(a) To compute ^ ik == h jL xa ik -w k for j+l^k^n (k=j+l ,j+2 , . . . ,n) , one 
multiplication is repeated (n- (j+1) +1) = (n-j ) times, so that 
computational complexity is (n-j)Mul. 

(b) To compute b i =h i ^b i -e, one multiplication is performed, 
so that computational complexity is IMul. 

Since counter i changes from j+1 to n, the computational 
complexity of step S118c for all values of counter i is 

(n-j+l)Mul* (n- (j+l)+l) 
= ((n-j)* (n-j+1) )Mul 
Accordingly, the total computational complexity of steps 
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S118a-S118c for one value of counter j is 



((3* (n-j+1) -6) + (n-j+1) + (n-j) (n-j+1) )Mul 



= (4* (n-j+1) -6+ (n-j) (n-j+1) )Mul 



= ((n-j + 4) (n-j+1) -6)Mul 



Since counter j changes from 1 to n-1, the total 
computational complexity of the equation transforming unit 102a 
is 



=lMul x (£j 2 +5 xXj -2 

j'l )'l 3-1 

=lMul* (1/6 *n (n-1) (2n-l) +5/2*n (n-1) -2 (n-1) ) 
=lMul x (l/6*n (n -1) (2n -1 +15) -2 (n -1) ) 
=lMul* (l/6*n (n-1) (2n+14) -2 (n-1) ) 
=lMul* (l/3*n (n-1) (n+7) -2 (n-1) ) 
=lMul* (1/3* (n-1) (n 2 +ln-6)) 
= (1/3 xn 3 +2n 2 -1 3/3 xn +2) Mul 



Therefore, the overall computational complexity of the 
equation solving unit 202 equipped with the equation transforming 
unit 102a is given by 

( (l/3*n 3 +2n 2 -13/3*n+2) + (4n-5) +1/2 xn (n+l))Mul 
+llnv 

= (l/3*n 3 +5/2xn 2 +l/6xn-3)Mul+Hnv 
Supposing Hnv=40Mul when n=5, the overall computational 



( (n -j +4) (n -j +1) -6) Mul 




complexity can be estimated at 142Mul. 
2.2. Other Modifications 

(1) In a communication system, such as a cryptographic 
communication system, a digital signature communication system, 
or an error correction communication system, whose security is 
based on the discrete logarithm problem on an elliptic curve E 
over an extension field GF(q) of a finite field GF(p) where p is 
a prime, q=p n , n is a positive integer, and G is a base point of 
E, the equation solving unit and the inversion apparatus of the 
invention may be used to calculate inverses of elements in the 
extension field GF ( q) . One example of cryptographic 
communication systems is an e-mail system on the Internet whereby 
messages are encrypted before transmission. One example' of 
digital signature communication systems is an electronic banking 
system. One example of error correction communication systems is 
an e-mail system whereby, in such cases that part of transmitted 
messa g e j_ s dropped due to deterioration in quality of a 
communication line, the error is detected and corrected. 

Also, the equation solving unit and the inversion apparatus 
of the invention may be used for encryption in a recording 
apparatus that encrypts copyrighted digital content using the 
elliptic curve discrete logarithm problem as the basis for 
security and records the encrypted digital content into a record 
medium such as a DVD or a semiconductor memory, or decryption in 
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a reproducing apparatus that decrypts the encrypted digital 
content stored in the record medium to reproduce the digital 
content . 

By applying the invention to these systems, the inverses of 
extension field elements can be computed with small computational 
complexity. 

In such applications, the equation solving unit and the 
inversion apparatus of the invention can be implemented, for 
example, as firmware stored in a mobile phone or a circuit board 
equipped in a personal computer. 

(2) Though the generator polynomial of the form g n -/3 has been 
used in the above embodiment, for an ordinary generator 
polynomial of the nth degree such as 

f(g) ^gf+Pn-iJ" 1 *- * •+P 2 g 2 +P 1 g+P 

the inverse J of an element x in an extension field GF(q) 
{q=*p n , n a positive integer) of a predetermined finite field 
GF(p) can be calculated in a similar manner. 

Let an ordinary polynomial f (g) of the nth degree be the 
generator polynomial and a be the root of f (g) . For an element 
x=x 0 +x 1 a+ • * • +x n _ 1 d l ~ 1 in the extension field GF (q) , when the 
coefficient of c/' 1 in {xxq?' 1 mod f(a)) is denoted by a ijf a system 
of linear equations in n unknowns can be written as 

a uyo+ a i2yi+ a i3y 2 +' m '^mYn-i^ 1 
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The reason that the system of linear equations in n unknowns 
can be written like this is given below. 
The equations 

xxl=xxy 0 +xxy 1 *ct+ - * •+xxy n _y I 
=1 mod f (a) 

and 

xxy 0 +xxy 1 *a+ - • • +xxy n l oP~ 1 

=xxy Q + (xx a mod f (a) ) xy 2 + • • • + (xxof 1 ' 1 mod f (a) ) xy n _ J 
hold. The coefficient of a?' 1 is given by 

a ii x Yo+ a i2 x yi+' 9 '+ a in X Yn-l 
The coefficients of cf' 1 (i>2) are all 0 and the coefficient 

of oP (i=l) is 1. Hence the above system of linear equations in 

n unknowns is derived. 

(3) The invention may be the equation solving method and the 
inversion method used in the above described equation solving 
unit and inversion apparatus. The invention may also be computer 
programs for implementing these methods, or digital signals for 
executing the computer programs. 

Also, the invention may be computer-readable storage mediums, 
such as floppy disks, hard disks, CD-ROMs, MOs, DVDs, DVD-ROMs, 
DVD-RAMS, or semiconductor memories, that store the computer 
programs or the digital signals. Likewise, the invention may be 
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the computer programs or digital signals stored in such storage 
mediums . 

Also, the invention may be realized by transferring the 
computer programs or the digital signals on a carrier wave via a 
network such as a telecommunication network, a radio or cable 
communication network, or the Internet. 

Further, the invention may be realized by distributing the 
computer programs or the digital signals stored in the storage 
mediums or transferring the computer programs or the digital 
signals on the carrier wave via the network so that they can be 
used in other computer systems . 

( 4 ) Various combinations of the embodiment and the 
modifications stated above are possible. 

Although the present invention has been fully described by 
way of examples with reference to the accompanying drawings, it 
is to be noted that various changes and modifications will be 
apparent to those skilled in the art. Therefore, unless such 
changes and modifications depart from the scope of the present 
invention, they should be construed as being included therein. 
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